Browser security settings matching lab

Match cert warnings, hash verify, private mode, and Secure DNS; leave ignore-cert and disable-updates unused.

Match each browser security ticket. Leave ignore-cert and disable-updates unused.

CompTIA 2.11 is browser hardening: cert warnings, hashing downloads, private mode, secure DNS, extensions, and pop-up/proxy settings.

Users click through red certificate warnings to make payroll work

Certificate trust — do not bypass.

Vendor posts a SHA-256 for the installer you just downloaded

Verify integrity before run.

Kiosk must not leave cookies/history for the next visitor

Private browsing / clear data.

Phish sites resolve on ISP DNS; harden name resolution in-browser

Secure DNS / DoH where policy allows.

Still on the bench

Stop — investigate certificate warnings; do not click through — MITM and bad hosts hide behind ignored cert errors.
Compare published hash to the downloaded file before install — Hashing catches tampered installers even from the right URL.
Private/InPrivate mode + clear cache on shared kiosks — Keeps the next user from inheriting sessions and history.
Enable browser Secure DNS / DoH per org policy — Encrypts DNS to a trusted resolver when policy allows.
Teach users Permanent exception on every red lock — Permanent exceptions train phishing success.
Disable browser updates so extensions stop breaking — Unpatched browsers are findings. Fix the extension, not the patch train.